CVE-2017-15092 | BDVDB-2026-95626 Detail

PowerDNSPowerDNS Recursor

Description#

A cross-site scripting issue has been found in the web interface of PowerDNS Recursor from 4.0.0 up to and including 4.0.6, where the qname of DNS queries was displayed without any escaping, allowing a remote attacker to inject HTML and Javascript code into the web interface, altering the content.

Impact#

No impact statement in the source data.

Weaknesses#

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

References#

http://www.securityfocus.com/bid/101982
https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2017-05.html

Exploit#

No public exploit known

History#

Version 12018-01-23Record published in the CVE List.
Version 22024-09-17Most recent update recorded in the CVE List.